From 6a5e61b1f7809ad4352aed77b3342ca68cfd8262 Mon Sep 17 00:00:00 2001 From: Charles Moulliard Date: Wed, 26 Jun 2024 09:17:44 +0200 Subject: [PATCH] Bump the versions of the operators (#164) * Bump the versions of the operators for: Tekton, GitOps & ArgoCD. Review instructions Signed-off-by: cmoulliard * Remove pipelineRun as resource to be excluded Signed-off-by: cmoulliard * Add RBAC for the backstage SA used to access the kubernetes resources Signed-off-by: cmoulliard --------- Signed-off-by: cmoulliard --- README.md | 71 ++++---- .../gitops/{argocd.tmpl => argocd.yml} | 168 +++++++++--------- manifest/installation/gitops/rbac.yml | 12 ++ .../gitops/subscription-gitops.yml | 2 +- .../tekton/subscription-pipelines.yml | 2 +- .../subscription-kubevirt-hyperconverged.yml | 2 +- 6 files changed, 133 insertions(+), 124 deletions(-) rename manifest/installation/gitops/{argocd.tmpl => argocd.yml} (94%) create mode 100644 manifest/installation/gitops/rbac.yml diff --git a/README.md b/README.md index e474b28..4f6d1c9 100644 --- a/README.md +++ b/README.md @@ -19,12 +19,12 @@ The backstage QShift application has been designed to showcase QShift (Quarkus o | Backstage plugin | Backend system | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------| | [Core - 1.27.x](https://github.com/backstage/versions/blob/main/v1/releases/1.23.4/manifest.json) | GitHub | -| [Kubernetes](https://backstage.io/docs/features/kubernetes/) | OpenShift 4.14 | -| [Quarkus front & backend](https://github.com/q-shift/backstage-plugins) | code.quarkus.io, OpenShift Virtualization 4.14.3 | -| [Quarkus Console](https://github.com/q-shift/backstage-plugins?tab=readme-ov-file#quarkus-console) | OpenShift 4.14 | -| ArgoCD [front](https://github.com/RoadieHQ/roadie-backstage-plugins/tree/main/plugins/frontend/backstage-plugin-argo-cd) & [backend](https://github.com/RoadieHQ/roadie-backstage-plugins/tree/main/plugins/scaffolder-actions/scaffolder-backend-argocd) | OpenShift GitOps 1.11.1 | -| [Tekton](https://github.com/janus-idp/backstage-plugins/tree/main/plugins/tekton) | OpenShift Pipelines 1.13.1 | -| [Topology](https://github.com/janus-idp/backstage-plugins/tree/main/plugins/topology) | OpenShift 4.14 | +| [Kubernetes](https://backstage.io/docs/features/kubernetes/) | OpenShift 4.15 | +| [Quarkus front & backend](https://github.com/q-shift/backstage-plugins) | code.quarkus.io, OpenShift Virtualization 4.15.2 | +| [Quarkus Console](https://github.com/q-shift/backstage-plugins?tab=readme-ov-file#quarkus-console) | OpenShift 4.15 | +| ArgoCD [front](https://github.com/RoadieHQ/roadie-backstage-plugins/tree/main/plugins/frontend/backstage-plugin-argo-cd) & [backend](https://github.com/RoadieHQ/roadie-backstage-plugins/tree/main/plugins/scaffolder-actions/scaffolder-backend-argocd) | OpenShift GitOps 1.12.3 | +| [Tekton](https://github.com/janus-idp/backstage-plugins/tree/main/plugins/tekton) | OpenShift Pipelines 1.15.0 | +| [Topology](https://github.com/janus-idp/backstage-plugins/tree/main/plugins/topology) | OpenShift 4.15 | | [DevTools](https://github.com/backstage/backstage/blob/master/plugins/devtools/README.md) | | **Note**: This backstage application is based on the backstage's version: 1.27.x @@ -32,7 +32,7 @@ The backstage QShift application has been designed to showcase QShift (Quarkus o ## Prerequisites - [nvm](https://github.com/nvm-sh/nvm) -- [Node.js](https://nodejs.org/en) (18 or 20.x but not 22 as it fails on macOS as node-gyp fails to build: isolated-vm) +- [Node.js](https://nodejs.org/en) (20.x but not 22 as it fails on macOS as node-gyp fails to build: isolated-vm) - [Yarn](https://yarnpkg.com/migration/guide). It is mandatory to migrate from yarn 1.x to 4.x and to enable `corepack enable` ! - [GitHub client](https://cli.github.com/) (optional) - [argocd client](https://argo-cd.readthedocs.io/en/stable/getting_started/#2-download-argo-cd-cli) (optional) @@ -41,7 +41,7 @@ The backstage QShift application has been designed to showcase QShift (Quarkus o ## Provision an ocp cluster -The following section details the different commands to be used to deploy the backend systems needed by QShift on a new OCP cluster (e.g. 4.14.10) +The following section details the different commands to be used to deploy the backend systems needed by QShift on a new OCP cluster (e.g. 4.15.x) #### Kubevirt @@ -75,21 +75,17 @@ kubectl apply -f subscription-gitops.yml To use ArgoCD with QShift, it is needed to delete the existing `ArgoCD` CR and to deploy our `ArgoCD` CR. -**Note**: Our CR includes different changes needed to work with QShift: `sourceNamespaces`, `extraConfig` and `tls.termination: reencrypt` and `resourceExclusions` +**Note**: Our CR includes different changes needed to work with QShift: +- `extraConfig: resource.customizations.health.PersistentVolumeClaim` to avoid that ArgoCD watch the PVC resources +- `tls.termination: reencrypt` to allow to access the ArgoCD route -**Todo**: The previous note should be documented to explain the changes needed ! - -```bash -kubectl delete argocd/openshift-gitops -n openshift-gitops -``` -Substitute within the `ArgoCD` CR the to be used using this command ```bash -cat argocd.tmpl | NAMESPACE= envsubst > argocd.yml +kubectl delete argocd/argocd -n openshift-gitops kubectl apply -f argocd.yml ``` -**Todo**: Instead of deleting and recreating a new ArgoCD CR, we should patch it or install it using kustomize, helm chart. Example: https://github.com/redhat-cop/agnosticd/blob/development/ansible/roles_ocp_workloads/ocp4_workload_openshift_gitops/templates/openshift-gitops.yaml.j2 +**Todo**: Instead of deleting and recreating a new ArgoCD CR, we should patch it or install it using kustomize. Example: https://github.com/redhat-cop/agnosticd/blob/development/ansible/roles_ocp_workloads/ocp4_workload_openshift_gitops/templates/openshift-gitops.yaml.j2 -Patch the `AppProject` CR to support to deploy the `Applications` CR in [different namespaces](https://github.com/q-shift/backstage-playground/issues/39#issuecomment-1938403564). +Patch the default `AppProject` CR to support to deploy the `Applications` CR in [different namespaces](https://github.com/q-shift/backstage-playground/issues/39#issuecomment-1938403564). ```bash kubectl get AppProject/default -n openshift-gitops -o json | jq '.spec.sourceNamespaces += ["*"]' | kubectl apply -f - ``` @@ -97,20 +93,7 @@ kubectl get AppProject/default -n openshift-gitops -o json | jq '.spec.sourceNam Finally, create a new ClusterRoleBinding to give the `Admin` role to the ServiceAccount `openshift-gitops-argocd-application-controller`. That will allow it to manage the `Applications` CR deployed in any namespace of the cluster. ```bash -cat << EOF | kubectl apply -f - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: argocd-controller-admin -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: admin -subjects: -- kind: ServiceAccount - name: openshift-gitops-argocd-application-controller - namespace: openshift-gitops -EOF +kubectl apply -f rbac.yml ``` #### Tekton @@ -174,14 +157,29 @@ The commands described hereafter will help you to set up what it is needed: ```bash kubectl create secret generic dockerconfig-secret --from-file=config.json ``` -- **Warning**: To let ArgoCD to handle the `Applications` CR within your namespace, it is needed to patch the resource `kind: ArgoCD` to add your namespace using the field: `.spec.sourceNamespaces`. When patched, the ArgoCD operator will roll out automatically the ArgoCD server. +- **Warning**: To allow Argo CD to manage resources in [other namespaces](https://docs.openshift.com/gitops/1.12/argocd_instance/setting-up-argocd-instance.html#gitops-deploy-resources-different-namespaces_setting-up-argocd-instance) apart from where it is installed, configure the target namespace with a `argocd.argoproj.io/managed-by` label. ```bash - kubectl get argocd/openshift-gitops -n openshift-gitops -o json \ - | jq '.spec.sourceNamespaces += [""]' | kubectl apply -f - + kubectl label namespace \ + argocd.argoproj.io/managed-by= ``` -- And finally, create the service account `my-backstage`. +- And finally, create the service account `my-backstage` and give it `admin` rights using the following RBAC to access the Kubernetes API resources. ```bash kubectl create sa my-backstage + NAMESPACE= +cat <